This policy is an agreement between the user and the organization. The policy outlines the appropriate use of the organization's assets and network, including what users may and may not do when accessing the network.

This policy would typically be acknowledged and implemented by all users in an organization.

This policy defines the security and system events that an organization should monitor, record, and review. Establishing an effective audit policy can help the organization spot security problems, ensure user accountability, and provide evidence in the event of a security breach.

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

This policy defines the process for making changes to the information resources in an organization. This process can help an organization minimize unplanned outages and unexpected system issues, and it can help the organization plan for these events accordingly. An effective change management process includes planning and monitoring, as well as communication, rollback, and follow-up procedures to reduce the negative effects that the change may cause for your users.

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

This policy defines the baseline configuration that laptops, desktops, systems, and other assets must have to maintain the integrity, confidentiality, and availability of these assets. This policy can help an organization ensure that each of its assets is tracked and maintained securely and correctly throughout the asset's life cycle.

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

This policy defines the processes, procedures, plans, and analyses that should be included in an organization's contingency plan. Establishing an effective contingency plan can enable the organization to return to its normal operations as quickly as possible after an unexpected event. 

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

This policy defines the categories of data that an organization handles and the controls that are required to protect the organization's data. Data is classified based on the organization's business needs and legal requirements.

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

Data Disposal Policy

This policy defines procedures for destroying or overwriting all devices and media that an organization no longer uses.

This policy would typically be acknowledged by all users in an organization and implemented by the organization's Information Technology, HR, Legal, and Finance departments.

This policy defines how only properly identified and authenticated users and devices should be granted access to an organization's information resources. All access to the organization's information resources should comply with the organization's security policies, standards, and procedures.

This policy would typically be acknowledged and implemented by all users in an organization.

This policy defines procedures for information security incidents that involve an organization. These procedures include incident handling, reporting, and monitoring, as well as incident response training, testing, and assistance. 

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

This policy defines procedures for an organization's anti-virus software and malware protection for the organization's users and systems. The policy can help to ensure the organization's systems and other devices are secure and being used correctly.

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

This policy defines procedures for protecting an organization's sensitive information when storing, transporting, and disposing of digital and non-digital devices and media.

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

This policy defines procedures and protocols for connecting and using mobile devices on an organization's network. 

This policy would typically be acknowledged and implemented by all users in an organization.

This policy defines procedures for hiring, training, and terminating members of an organization, according to the organization's information security program. 

This policy would typically be acknowledged and implemented by an organization's Information Technology and Human Resources departments. 

This policy defines procedures for protecting an organization's information assets by using physical and environmental controls. These controls should prevent tampering, damage, theft, or unauthorized physical access to information assets.

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

Record Retention Policy

This policy establishes a retention schedule for an organization’s records and aims to ensure that the organization properly protects and preserves its essential records and documents. The policy also establishes a process for records that an organization is no longer required to keep or records that are no longer beneficial, and ensures that the organization disposes of the records as soon as possible.

This policy would typically be acknowledged and implemented by an organization's Legal and Human Resources departments.

This policy defines procedures for protecting business assets and members of an organization while the organization conducts risk assessments.

This policy would typically be acknowledged and implemented by members of the organization who are involved in risk assessment efforts.

This policy defines procedures for protecting business assets and members of an organization while the organization manages risks.

This policy would typically be acknowledged and implemented by members of the organization who are involved in risk assessment and management efforts.

Security Awareness Training and Testing Policy

This policy specifies an organization’s internal information security awareness and training program. The program should inform and assess all members of the organization regarding their information security responsibilities. 

This policy would typically be acknowledged and implemented by all users in an organization.

This policy establishes and defines the process of implementing system and information integrity controls. These controls can be used to maintain the confidentiality, integrity, and availability of an organization's systems, including the data that is transmitted, processed, received, and stored on those systems.

This policy would typically be acknowledged and implemented by an organization's Information Technology department.

This policy establishes the process of addressing security risks that are related to third-party relationships. This policy is designed to help an organization implement a third-party information security due diligence process.

This policy would typically be acknowledged and implemented by members or an organization who are involved with third-party provider relationships, such as the Information Technology, Legal, Integrations, and Procurement departments. 

This policy defines procedures and protocols for protecting and controlling access to an organization's information and assets. 

This policy would typically be acknowledged and implemented by an organization's Information Technology department.